Upgrade to Pro — share decks privately, control downloads, hide ads and more …

EASM mistakes waiting to happen

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for JR0ch17 JR0ch17
January 25, 2022
Technology
62
0

EASM mistakes waiting to happen

Avatar for JR0ch17

JR0ch17

January 25, 2022

More Decks by JR0ch17

See All by JR0ch17
Traversing my way in the internal network
Avatar for JR0ch17 jr0ch17
0
190
Getting Started in Bug Bounty
Avatar for JR0ch17 jr0ch17
0
180
Getting Blindly Lucky
Avatar for JR0ch17 jr0ch17
0
110
Qu'est-ce que le bug bounty?
Avatar for JR0ch17 jr0ch17
0
170
Finding 5 bugs in a single parameter
Avatar for JR0ch17 jr0ch17
0
130
Beyond the Borders of Scope
Avatar for JR0ch17 jr0ch17
1
110
Bad API, hAPI Hackers!
Avatar for JR0ch17 jr0ch17
0
1.6k

Other Decks in Technology

See All in Technology
ガバメントクラウドでのランサムウェア対策
Avatar for 高橋広和 techniczna
1
760
AI ネイティブな組織に Gemini Enterprise Agent Platform がなぜ必要なのか
Avatar for Asei Sugiyama asei
1
170
Sansan Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4.9k
ブラウザ研修 2026
Avatar for Recruit recruitengineers
PRO
3
460
『三匹の子ぶた』から学ぶネットワークセキュリティの昔と今 / Network Security: Then and Now Through the Lens of The Three Little Pigs
Avatar for NTT docomo Business nttcom
1
1.7k
PLaMoを毎日の開発で使い育てていく
Avatar for Preferred Networks pfn
PRO
0
180
【５分でわかる】セーフィー エンジニア向け会社紹介
Avatar for Safie safie_recruit
0
53k
モノリス Rails でも日中に rails db:migrate を走らせたい！ / Daytime rails db:migrate on Monolithic Rails!
Avatar for Shintani Teppei euglena1215
3
420
事業価値と Engineering 2026年度版
Avatar for Recruit recruitengineers
PRO
29
16k
クラウドセキュリティ入門　～安全なクラウド利用のための基礎知識～
Avatar for LHazy lhazy
8
7.6k
AIがコードを書く時代、人間は何を保証するのか———馬場さんと考える、開発者に求められる新しい責任と価値 - TECH PLAY
Avatar for Toshiaki Baba netmarkjp
0
1.3k
[MIRU26] Open-Vocabulary Intention-Guided Object Detection in Diverse Scenes
Avatar for Semantic Machine Intelligence Lab., Keio Univ. keio_smilab
PRO
0
140

Featured

See All Featured
Measuring & Analyzing Core Web Vitals
Avatar for Philip Tellis bluesmoon
9
950
The Illustrated Guide to Node.js - THAT Conference 2024
Avatar for David Neal reverentgeek
1
420
Evolving SEO for Evolving Search Engines
Avatar for Ryan Jones ryanjones
0
250
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
8.2k
Fight the Zombie Pattern Library - RWD Summit 2016
Avatar for Marcelo Somers marcelosomers
234
17k
How to build an LLM SEO readiness audit: a practical framework
Avatar for Nick Samuel nmsamuel
1
820
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
85
9.6k
Leveraging Curiosity to Care for An Aging Population
Avatar for Cassini Nazir cassininazir
1
460
Visual Storytelling: How to be a Superhuman Communicator
Avatar for David Neal reverentgeek
2
610
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
9
1.5k
How Fast Is Fast Enough? [PerfNow 2025]
Avatar for Tammy Everts tammyeverts
3
690
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6.2k

Transcript

  1. EASM mistakes waiting to happen

  2. GET /whoami HTTP/2 Jasmin Landry JR0ch17 Lead, IT & Security

    at Montreal Canadiens fan

  3. GET /agenda HTTP/2 EASM Common mistakes Hacker perspective

  4. GET /EASM HTTP/2 What exactly is EASM? What does it

    cover? Why is it important?

  5. GET /common_mistakes HTTP/2 Lack of Change Management Not respecting Least

    Privilege Misconfigured WAFs Cloud misconfigs (S3 buckets)

  6. GET /hacker_perspective HTTP/2 • Subdomains • IPs • TLS certificates

    • Third-party apps Recon EVERYTHING • Monitor for new assets • Monitor any change Continuous Monitoring

  7. GET /thanks HTTP/2 Thank you for listening Questions? More questions?

    DMs are open on and